High Severity WordPress Plugin Bug Hits Three Million

Security authorities are urging users of a well known WordPress plugin to update immediately after a bug was located that could make it possible for attackers to steal sensitive details and most likely even hijack vulnerable web sites.

UpDraft In addition describes by itself as “the world’s most dependable WordPress backup.”

This helps make it a “treasure trove” of useful details, including configuration documents that could be utilized to accessibility websites’ backend databases and their contents, warned security seller Wordfence.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper take secure and enxrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized seller: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Sadly, the new vulnerability (CVE-2022-0633) could enable any logged-in consumer, together with subscriber-level buyers, to download backups manufactured with the plugin.

“One of the options that the plugin executed was the capability to mail backup down load hyperlinks to an email of the web-site owner’s alternative,” the firm defined. “Unfortunately, this performance was insecurely carried out earning it feasible for low-level authenticated users like subscribers to craft a valid url that would allow them to down load backup data files.”

Risk actors would need to have an energetic account on a victim’s method to exploit the vulnerability, which means it would be largely confined to remarkably focused attacks. On the other hand, a CVSS rating of 8.5 is rated large severity.

“The outcomes of a effective focused attack are most likely to be extreme, as they could include leaked passwords and PII, and in some situations web site takeover if the attacker is capable to get hold of database credentials from a configuration file and productively accessibility the web-site databases,” mentioned Wordfence.

All UpDraft Plus buyers are urged to enhance to model 1.22.3, fixing the bug.

“WordPress represents one particular of the premier backends of sites on the internet. The security troubles in WordPress occur from its vast ecosystem of plugins that run the gamut from capable developers to hobbyists,” spelled out Netenrich principal threat hunter, John Bambenek.

“Access to the backups and database will most likely first be applied for credential theft but there are several alternatives for attackers to get advantage of the information and facts. It is a very good and proactive shift for WordPress to have its very own danger intel team that is doing the job vulnerabilities in third-party plugins.”